`auth_key` sounds wrong for some reason and underscores looks strange in a URL to me.. Let's go with `?api-key=XXXXX` along with an `x-api-key` header. Either should work.